1
Factoring Large Numbers Factoring Large Numbers with the TWIRL Devicewith the TWIRL Device
Adi Shamir, Eran TromerAdi Shamir, Eran Tromer
2Bicycle chain sieve [D. H. Lehmer, 1928]Bicycle chain sieve [D. H. Lehmer, 1928]
3
The Number Field SieveInteger Factorization Algorithm
• Best algorithm known for factoring large integers.
• Subexponential time, subexponential space.
• Successfully factored a 512-bit RSA key in 1999 (hundreds of workstations running for many months).
• Record: 530-bit integer factored in 2003.
4
NFS: Main stepsRelation collection (sieving) step:Find many numbers satisfying a certain (rare) property.
Matrix step:
Find a linear dependency among the numbers found.
5
NFS: Main stepsRelation collection (sieving) step:Find many numbers satisfying a certain (rare) property.
Matrix step:
Find a linear dependency among the numbers found.
This work
Cost dramatically reduced by [Bernstein 2001] followed by [LSTT 2002] and [GS 2003].
6
Cost of sieving for RSA-1024 in 1 year
• Traditional PC-based: [Silverman 2000]
100M PCs with 170GB RAM each: $ 51012
• TWINKLE: [Lenstra,Shamir 2000][Silverman 2000]*
3.5M TWINKLEs and 14M PCs: ~ $ 1011
• Mesh-based sieving [Geiselmann,Steinwandt 2002]*
Millions of devices, $ 1011 to $ 1010 (if at all?)Multi-wafer design – feasible?
• Our design: $10M using standard silicon technology (0.13um, 1GHz).
7
The Sieving ProblemInput: a set of arithmetic progressions. Each progression has a prime interval p and value log p.
OOO
OOO
OOOOO
OOOOOOOOO
OOOOOOOOOOOO
Output: indices where the sum of values exceeds a threshold.
8
1024-bit NFS sieving parameters
• Total number of indices to test: 31023.
• Each index should be tested against all primes up to 3.5109.
9
Three ways to sieve your numbers...
41O3731O2923O19O17O13OO11OOO7OOO5OOOOO3OOOOOOOOO2OOOOOOOOOOOO
0123456789101112131415161718192021222324
prim
es
indices (a values)
10
Tim
e
41O3731O2923O19O17O13OO11OOO7OOO5OOOOO3OOOOOOOOO2OOOOOOOOOOOO
0123456789101112131415161718192021222324
Memory
One contribution per clock cycle.PC-based sieving, à la Eratosthenes
276–194 BC
11
Co
un
ters
TWINKLE: time-space reversal
41O3731O2923O19O17O13OO11OOO7OOO5OOOOO3OOOOOOOOO2OOOOOOOOOOOO
0123456789101112131415161718192021222324
Time
One index handled at each clock cycle.The Weizmann Institute Key
Locating Engine
[Shamir 99]
12
Var
iou
s ci
rcu
its
TWIRL: compressed time
41O3731O2923O19O17O13OO11OOO7OOO5OOOOO3OOOOOOOOO2OOOOOOOOOOOO
0123456789101112131415161718192021222324
Time
s=5 indices handled at each clock cycle. (real: s=32768)
The Weizmann Institute Relation
Locator
13
0
1
2
3
4
Parallelization in TWIRLTWINKLE-like
pipelinea=0,1,2,…
14
Parallelization in TWIRLTWINKLE-like
pipeline Simple parallelization with factor sa=0,s,2s,…
TWIRL with parallelization factor sa=0,s,2s,…a=0,1,2,…
s-1
15
Example (simplified): handling large primes• Each prime makes a contribution once per 10,000’s of clock
cycles (after time compression); inbetween, it’s merely stored compactly in DRAM.
• Each memory+processor unit handles 10,000’s of progressions. It computes and sends contributions across the bus, where they are added at just the right time. Timing is critical.
Memory
Pro
cess
or
Memory
Pro
cess
or
16
Handling large primes (cont.)
Memory
Pro
cess
or
17
Implementing a priority queue of events
• The memory contains a list of events of the form (pi,ai), meaning “a progression with interval pi will make a contribution to index ai”. Goal: implement a priority queue.
1. Read next event (pi,ai).2. Send a log pi contribution to
line ai (mod s) of the pipeline.
3. Update aiÃai+pi
4. Save the new event (pi,ai) to the memory location that will be read just before index ai passes through the pipeline.
• To handle collisions, slacks and logic are added.
• The list is ordered by increasing ai.• At each clock cycle:
18
Handling large primes (cont.)• The memory used by past events can be reused.
• Think of the processor as rotating around the cyclic memory:
Pro
cess
or
19
Handling large primes (cont.)• The memory used by past events can be reused.
• Think of the processor as rotating around the cyclic memory:
• By assigning similarly-sized primes to the same processor (+ appropriate choice of parameters), we guarantee that new events are always written just behind the read head.
• There is a tiny (1:1000) window of activity which is “twirling” around the memory bank. It is handled by an SRAM-based cache. The bulk of storage is handled in compact DRAM.
Pro
cess
or
20
Rational vs. algebraic sieves
• In fact, we need to perform two sieves: rational (expensive) and algebraic (even more expensive).
• We are interested only in indices which pass both sieves.
• We can use the results of the rational sieve to greatly reduce the cost of the algebraic sieve.
algebraic
rational
21
Notes
• TWIRL is a hypothetical and untested design.
• It uses a highly fault-tolerant wafer-scale design.
• The following analysis is based on approximations and simulations.
22
TWIRL for 512-bit composites
One silicon wafer full of TWIRL devices (total cost ~$15,000) can complete the sieving in under 10 minutes. This is 1,600 times faster than the best previous design.
23
TWIRL for 1024-bit composites
• Operates in clusters of 3 almost independent wafers.
• Initial investment (NRE): ~$20M
• To complete the sieving in 1 year• Use 194 clusters (~600 wafers).
• Silicon cost: ~$2.9M
• Total cost: ~$10M (compared to ~$1T).
A
R
R R
RR
R R
R
24
.
Top Related